Is ChatGPT Safe? The Real Risks in 2026 and What to Do About Each

Is ChatGPT safe? For everyday questions, writing and brainstorming, yes. The app OpenAI ships is not malware, and the two security incidents OpenAI has disclosed since November 2025 exposed no chats or passwords. You also control whether your conversations train its models. The risks sit elsewhere. They are what you type, answers that sound right and are not, and fake ChatGPT download sites that have already served password-stealing malware to Mac users.

This guide takes each risk in turn. It covers what OpenAI keeps and for how long, who else could see it, which jobs ChatGPT is not built for, and the settings that close most of the gap. Every policy below comes from OpenAI's own help center and announcements, checked on 5 October 2026.

The Key Takeaways

• Training is on by default: Free, Go, Plus and Pro chats train OpenAI's models until you switch off Improve the model for everyone. Business, Enterprise and Edu workspaces are excluded by default.
• Deleted means gone in 30 days: deleted chats and Temporary Chats leave OpenAI's systems within 30 days. The court order that forced indefinite retention ended on 26 September 2025.
• The bigger Mac risk is fake apps: a cloned ChatGPT download page served Odyssey Stealer to Mac users in May 2026, according to Malwarebytes.
• No legal privilege: Sam Altman has said ChatGPT conversations lack the confidentiality you get with a lawyer, doctor or therapist.
• Ads, but not everywhere: ads run on Free and Go only, never beside personal health, mental health or politics, and never for accounts identified as under 18.

Is ChatGPT Safe? The Short Answer

ChatGPT is safe for low-stakes work and needs care for anything you would not put in an email to a stranger. The useful question is not whether ChatGPT is safe in general but whether it is safe for the job in front of you. The table below gives the verdict for the eight jobs people ask about most, with the one change that makes each one safer.

The rest of this guide explains each row, starting with the one that applies to every user: what happens to the words you type.

What Happens to What You Type in ChatGPT

ChatGPT stores every regular conversation in your account until you delete it, and on personal plans it uses those conversations to train OpenAI's models unless you opt out. Three details decide how private that really is.

Training Is On by Default on Personal Plans

The switch is called Improve the model for everyone, under Settings, then Data controls. OpenAI's data controls help page says that once it is off, new conversations are not used to train its models. Turning it off does not delete anything, and old chats stay in your history. Our guide to stopping AI from training on your data covers the same switch for Claude and Gemini.

Work plans flip the default. OpenAI does not train on ChatGPT Business, Enterprise, Edu or ChatGPT for Healthcare workspaces unless the organisation opts in.

Deleted Chats Are Gone Within 30 Days, With One Exception

A deleted ChatGPT chat disappears from your account at once and is scheduled for permanent deletion from OpenAI's systems within 30 days. The exceptions are chats already de-identified and chats OpenAI must keep for security or legal reasons. Temporary Chats follow the same 30-day clock, never appear in your history and never create memories.

The legal exception is not hypothetical. In 2025 a court order in The New York Times' copyright case forced OpenAI to keep even deleted consumer chats indefinitely. OpenAI says those obligations ended on 26 September 2025. It still holds a limited set of user data from April to September 2025, locked down and accessible only to a small audited legal and security team.

The Feedback Button Trap

The thumbs-up and thumbs-down buttons override your opt-out. OpenAI's data controls page says that giving feedback on a response makes the entire conversation behind it eligible for training, even with model training switched off. If a chat holds something sensitive, do not rate it. The full list of what ChatGPT collects, from location to the Mac app's Computer History, is in our guide to what ChatGPT collects and who can see it.

Is ChatGPT Safe From Hackers?

The two security incidents OpenAI has disclosed since November 2025 touched neither ChatGPT conversations nor passwords. Both are worth knowing because both ended in the same advice.

In November 2025 an attacker broke into Mixpanel, an analytics vendor OpenAI used for its developer platform. OpenAI says the stolen data was limited to names, email addresses, rough locations and browser details. It covered some API users and a small number of ChatGPT users who had filed help tickets. No chats, API keys, passwords or payment details were exposed, and OpenAI dropped Mixpanel.

In March 2026 a poisoned version of Axios, a widely used developer library, ran inside the GitHub workflow OpenAI uses to sign its Mac apps. OpenAI found no evidence that user data or its products were compromised. As a precaution, it still treated the signing certificate as compromised, rotated it, and stopped supporting older Mac app versions from 8 May 2026.

The lesson from both is to switch on multi-factor authentication in ChatGPT's security settings. OpenAI recommended it after Mixpanel, because stolen names and emails are raw material for convincing phishing.

Fake ChatGPT Apps Are the Real Mac Risk

The likeliest way ChatGPT hurts a Mac owner is not ChatGPT at all. It is a fake installer wearing its logo.

The Cloned Download Page

In May 2026 Malwarebytes documented a fake ChatGPT download site, openew[.]app, that copied OpenAI's real download page. Windows visitors got a credential-stealing loader. Mac visitors got Odyssey Stealer, a fork of the Atomic Stealer family. It copies the macOS keychain, saved browser passwords, cookies, Telegram sessions and crypto wallets, then tries to swap Ledger and Trezor wallet apps for trojanised copies.

Lookalike addresses work because people mistype AI names all the time. The most common AI misspellings get millions of US searches a month, and security researchers have already found malware domains built on them.

Malwarebytes' explanation for why AI brands attract this is simple. Most people install ChatGPT, Claude or Gemini for the first time through a search result or an ad, without knowing the official address. That first search is where the fake pages wait.

When macOS Flagged the Real App

In May 2026 macOS moved the genuine ChatGPT app to the Trash as malware for some users who had not updated, Moonlock reported. The cause was OpenAI's certificate rotation, the app was safe, and the fix was updating it. OpenAI's rule from that incident: "Do not install apps from links in emails, messages, ads, or third-party download sites." Install from OpenAI's site, reached by typing the address, and update from inside the app.

ChatGPT Gets Things Wrong, Confidently

ChatGPT invents facts, and OpenAI says so plainly: its September 2025 research note on hallucinations calls them a fundamental challenge for every large language model, ChatGPT included. A wrong answer delivered in a confident tone is the most common harm ChatGPT does to ordinary users.

OpenAI's own numbers show the size of it. Its GPT-5 system card and its hallucination research note report a fact test called SimpleQA, run without web search. There, gpt-5-thinking-mini gave a wrong answer 26% of the time and declined to answer 52% of the time. The older o4-mini answered almost everything and was wrong 75% of the time. OpenAI's explanation is that standard training and testing reward a lucky guess over an honest admission of uncertainty.

The safe habit follows from that. Treat a ChatGPT answer about health, money, law or a named person as a draft to check, not a conclusion. Ask for sources, open them, and read the line it quoted.

Check an Answer With a Second Model

The fastest check is asking a second model the same question. Models trained by different companies make different mistakes, so agreement between them is a signal and disagreement is a flag to dig further. Fello AI puts GPT, Claude, Gemini, Grok, DeepSeek and others in one Mac and iPhone app, so a second opinion is one model switch away instead of a second subscription.

Agents and Prompt Injection

ChatGPT becomes riskier the moment it can act for you. When an agent such as ChatGPT Work, OpenAI's agent mode reads web pages, emails or documents, text hidden inside them can try to give it new orders. That attack is called prompt injection, and OpenAI describes it as "a frontier, challenging research problem" rather than a solved one.

OpenAI's own example is an agent asked to answer your overnight email that meets a planted message and ends up sending your bank statements to the attacker. The company's advice for users comes down to four habits. Limit an agent to the data and logins the task needs. Give it a specific instruction rather than a broad one like "review my emails and take whatever action is needed". Read every confirmation before approving it. And watch the agent while it works on a sensitive site such as your bank.

Real cases already exist. Our explainer on how prompt injection works walks through attacks on Claude Cowork and on email agents. The running list of AI safety incidents in 2026 records what agents did when given real access.

Is It Safe to Put Medical Records Into ChatGPT?

Medical records in ChatGPT get stronger protection than ordinary chats but none of the legal protection they had at your doctor's office. Which one matters more is your call.

OpenAI launched Health in ChatGPT to US users aged 18 and over on 23 July 2026, on web and iOS, across Free, Go, Plus and Pro. Its launch post is direct: "The information connected in Health is not used to train our foundation models or target ads." That holds regardless of your training setting. Connected data gets extra encryption, ChatGPT asks before using it by default, and disconnecting a source deletes its synced data within 30 days.

HIPAA is the part that does not travel. The US Department of Health and Human Services says HIPAA binds only health care providers, health plans, clearinghouses and their business associates. A consumer app you connect yourself is none of those, so your records rest on OpenAI's promises, not federal law. Our walkthrough of connecting Apple Health to ChatGPT covers the setup and the delete steps.

Is ChatGPT Safe for Legal Work and Therapy?

ChatGPT is not confidential the way a lawyer, doctor or therapist is, and OpenAI's chief executive has said so himself. On Theo Von's podcast in July 2025, as TechCrunch reported, Sam Altman described people using ChatGPT as a therapist or life coach. Then he said: "And we haven’t figured that out yet for when you talk to ChatGPT." He meant legal privilege. In a lawsuit, OpenAI could be required to hand those conversations over.

For a legal problem, that means drafting questions in ChatGPT is fine, and pasting the facts of your case is not. Use it to understand terms and prepare for the lawyer, not to replace the privileged conversation.

Emotional conversations carry a second risk beyond privacy. OpenAI estimated in October 2025 that about 0.15% of weekly active users had conversations with explicit signs of suicidal planning or intent. It says its updated model cut responses that fall short of its own safety standard in those conversations by 65%, and points people toward crisis lines and real-world support. ChatGPT works as a place to think out loud. It is not a substitute for a person who can act when something is wrong.

Ads, Kids and What Advertisers See

ChatGPT began testing ads in the United States on 9 February 2026 and has since rolled them out in more regions, on the Free and Go plans only. Plus, Pro, Business, Enterprise and Edu accounts have none. OpenAI's ads help page sets the limits that matter for safety:

The under-18 rule is one piece of ChatGPT's teen protections, which also include age prediction, content limits, parent alerts and quiet hours. Most of them need a parent to link accounts, and even then they are not a safety net. On 7 October 2026, Common Sense Media's Youth AI Safety Institute rated ChatGPT for Teens an Unacceptable Risk after testing more than 4,000 prompts on accounts registered to 13- to 17-year-olds. Testers spent up to an hour discussing suicide, self-harm or disordered eating on newly created, parent-linked accounts, and the parents received zero alerts. ChatGPT also missed more than one in four crisis referrals the testers judged necessary.

OpenAI disputes the method. It told Axios that much of the alert testing happened before the parent and teen accounts had finished linking, which it says can take several hours. Common Sense's advice is that parents should not rely on built-in protections and alerts, and OpenAI itself says the guardrails are not foolproof. Our guide to setting up ChatGPT parental controls covers every setting and what a determined teenager can still get around.

Is ChatGPT Safe for Business Use?

ChatGPT is safe for business use on a business plan, and a poor choice for company data on a personal one. The difference is contractual, not technical.

On ChatGPT Business, Enterprise and Edu, OpenAI does not train on your data by default, and you own your inputs and outputs where the law allows. OpenAI encrypts data at rest with AES-256 and in transit with TLS 1.2 or later, and its business products have passed SOC 2 Type 2 audits. Enterprise admins set how long data is kept.

Two caveats belong in any company policy. On ChatGPT Business, workspace admins can view, export and delete the conversations of people in the workspace, and Enterprise admins can pull an audit log of conversations through OpenAI's Compliance API. A work account is private from OpenAI's training, not from your employer. And an employee pasting a client file into a personal Plus account bypasses every one of those protections, which is the leak most companies actually suffer.

How to Use ChatGPT Safely: 8 Steps

These eight steps take about five minutes and close most of the gaps covered in this guide.

1. Turn off model training: Settings, then Data controls, then switch off Improve the model for everyone.
2. Use Temporary Chat for anything sensitive: it stays out of your history, creates no memories and is not used for training.
3. Do not rate sensitive chats: a thumbs-up or thumbs-down makes the whole conversation eligible for training.
4. Switch on multi-factor authentication in ChatGPT's security settings.
5. Install only from OpenAI: type the address yourself and update from inside the app. Never install from an ad, an email or a file-sharing link.
6. Keep identifiers out: passwords, ID numbers, card numbers and other people's private details never belong in a prompt.
7. Give agents narrow jobs and read every confirmation before you approve it.
8. Check anything that matters against a source or a second model before you act on it.

The Verdict

ChatGPT is safe enough for most of what people use it for. OpenAI's policies are also clearer and more protective in 2026 than in 2025. Deleted chats are deleted again, ads stay away from health and minors, and business data is excluded from training by default. What it is not is confidential. Treat every chat as something a company stores and a court could request, keep the training switch off, and get the Mac app only from OpenAI. Do those three things and the biggest remaining risk is believing a wrong answer, which a second opinion fixes.

FAQ